Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/11/2026, 15:35
General
- Target b07e2fa734a0e20217a1bc092b54f9ee4587fb97541f658e010eb62ef4e96d13.exe
- Size 4.2MB
- Sample261102-s1fh4aa18x
- SHA256 b07e2fa734a0e20217a1bc092b54f9ee4587fb97541f658e010eb62ef4e96d13
Malware Config
Signatures
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 33 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b07e2fa734a0e20217a1bc092b54f9ee4587fb97541f658e010eb62ef4e96d13.exe"C:\Users\Admin\AppData\Local\Temp\b07e2fa734a0e20217a1bc092b54f9ee4587fb97541f658e010eb62ef4e96d13.exe"1⤵
- Direct Volume Access: Opens a physical disk for reading
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c md "C:\Users\Admin\AppData\Local\Temp\7z-boot"2⤵
- Executes a command shell one-liner
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c ver2⤵
- Executes a command shell one-liner
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4992-1-0x0000000000DBE000-0x0000000000DBF000-memory.dmp
memory/4992-0-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-7-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-24-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-34-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-35-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-36-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-37-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-38-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-39-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-40-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-41-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-42-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-43-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-44-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-45-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-46-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-47-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-48-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-49-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-51-0x0000000000DBE000-0x0000000000DBF000-memory.dmp
memory/4992-50-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-52-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-53-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-54-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-55-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-56-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-57-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-58-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-59-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-60-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-61-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-62-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-63-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-64-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-65-0x0000000000400000-0x0000000000DCD000-memory.dmp
memory/4992-66-0x0000000000400000-0x0000000000DCD000-memory.dmp